I have a Jellyfin server, NextCloud instance, etc that I share with friends and family. Currently, I serve them over the open-internet using Cloudflare tunnels. Obviously this has some security implications that I don’t love. Also recently one of my domains got flagged as malicious by google and now Chrome browsers won’t go to the site - annoying.
I use Tailscale already to access my server infra remotely, but honestly I don’t see this as a viable option for my non-technical friends and family. Plus, I need to support all kinds of devices like smart tvs. How do you fine folks deal with this issue?
I have a domain which points to my router (over dynamic DNS). My parents’ Router connects to my home network via Wireguard using that. All my services have subdomains, for which I have set static DNS records that point to the local address (192.168…) of my server. This way, I only need to expose Wireguard to the public.
My home server is reachable via dynamic DNS. Nextcloud ist running from a VM that has no other ports open and I have done all the security things that the automatic checks have recommended.
Once you agree to letting friends and family access your hosted services, you become the tech support for any problems. Whether that be your fault, user error, etc. You should absolutely limit who you give access to. In my case, only three people can and that’s immediate family. No friends, no extended family. I don’t wanna deal with all that mess when I deal with it at work. Don’t over extend yourself by being nice.
Using Cloudflare is against the ToS when used for services like Jellyfin. Your account can be limited, closed, or find yourself getting a several hundred dollar bill for data usage because you’ve breached the terms of service. Additionally, streaming content on free accounts incurs higher latency which I’ve confirmed myself Argo smart routing massively reduces. https://github.com/jellyfin/jellyfin/issues/9295 - Don’t abuse what’s free or you may lose it.
Google shouldn’t be indexing your domains anyway. If it’s flagged your domain, it’s been indexed and scanned. Alternatively, it could indicate you have a weak point somewhere on your server and you’ve been breached. Google’s scan picked up whatever it was. Though I doubt this is the case and just a false positive. Double check your robots.txt files and disallow everything. Most index bots respect this. You can use a community sourced bot blocker. https://github.com/mitchellkrogza/nginx-ultimate-bad-bot-blocker
I’ve been running my own self hosted services for almost a decade. Though I have a background in IT directly doing this kind of stuff daily at work. As long as you have a strong firewall, modern TLS, relevant security headers, automatic tools like fail2ban, and have a strong grasp on permissions, you should be fine. Before I moved everything to non-root docker, it was given its own service user and SELinux policy. Using direct DNS isn’t so much of a problem. You shouldn’t have any issues. Feel free to reach out if you have any questions.
RE: CloudFlare TOS, Not anymore. They removed section 2.8 from their TOS, so all content can be served through CloudFlare now, as long as it doesn’t use the CDN.
The Google warning page isn’t from a scan. I’ve seen it show up when visiting an entirely internal site in Chrome. It’s not exposed to the Internet, and the domain name doesn’t even exist in public DNS.
I’m hoping it’s just a false positive. I have everything setup to not be indexed, and I just signed up for the google search console (to submit an appeal) and the console confirmed this. I was using cloudflare to block “bots and scrapers” and that seems to have blocked Google’s scraper/indexer. My best guess is they might have flagged it just for that, so I’ve turned it off for now.
As for security, it’s an ever-evolving thing but I’m looking at ways to tighten it up. Since everything is behind Cloudflare, I also have them setting up SSL certs, and running firewalls. This lets me auto-ban “known malicious actors”, as well as any IP’s that aren’t geo-located to the US. Server-side, it’s not great though. I’m running unraid, which is… not known for it’s security. Not sure if there is much I can do about that though until I re-architect everything on a proper server.
You should for sure move away from a proprietary OS. There are many ways to go about it. I personally use Arch minimal with hardened kernel. Everything runs in non-root docker containers. Commonly used distros are Ubuntu and Fedora. But there are many more to choose from. https://distrowatch.com/search.php?category=Server
Yeah, I used to run on proxmox and tried to roll-my-own stuff. I found it to be a lot of work in the areas I was less interested in, if that makes sense. I liked unraid for it’s ease of use, although I think in the end the gameplan is still to eventually move docker/applications off of the unraid box and have it be only for storage. Then I can have a regular linux box for all my applications & vms.
I set up everything behind Authentik SSO so that, when they ask me to set them up with jellyfin to watch movies & tv, they suddenly have access to a whole suite of tools. That way, they can explore on their own and decide - which seems to work well. Not sure what kind of users you have, but mine are very quick to ring me up when something is not working!
I’m quite terrible at keeping up with folks, and so I find these support calls to be a great way to keep in touch actually! But I could definitely see it getting annoying too.
As much as I like fully self hosting, I ended up paying for Plex lifetime and have it running in docker. It was $120, but has already paid for itself twice over since I managed to convince my wife to drop hbo max, Netflix, and a couple others. She isn’t technical at all so she was hesitant, but she likes plex. If she can’t find what she wants to watch on our few streaming services (paid for by our cell provider, otherwise they’d be cancelled too), she can add it to the watchlist on Plex and radarr or sonarr will download it automatically and make it available on plex pretty quickly (or she’ll tell me to get it and let her know when it’s done).
I could open my Plex server to more family or friends, but most of them either pirate stuff themselves or are fine with paying for streaming services for the ease of use.
You are not logged in. However you can subscribe from another Fediverse account, for example Lemmy or Mastodon. To do this, paste the following into the search field of your instance: !selfhosted@lemmy.world
A place to share alternatives to popular online services that can be self-hosted without giving up privacy or locking you into a service you don’t control.
Rules:
Be civil: we’re here to support and learn from one another. Insults won’t be tolerated. Flame wars are frowned upon.
No spam posting.
Posts have to be centered around self-hosting. There are other communities for discussing hardware or home computing. If it’s not obvious why your post topic revolves around selfhosting, please include details to make it clear.
Don’t duplicate the full text of your blog or github here. Just post the link for folks to click.
Submission headline should match the article title (don’t cherry-pick information from the title to fit your agenda).
No trolling.
Resources:
selfh.st Newsletter and index of selfhosted software and apps
I have a domain which points to my router (over dynamic DNS). My parents’ Router connects to my home network via Wireguard using that. All my services have subdomains, for which I have set static DNS records that point to the local address (192.168…) of my server. This way, I only need to expose Wireguard to the public.
My home server is reachable via dynamic DNS. Nextcloud ist running from a VM that has no other ports open and I have done all the security things that the automatic checks have recommended.
Nobody has dared so far to call me malicious.
Once you agree to letting friends and family access your hosted services, you become the tech support for any problems. Whether that be your fault, user error, etc. You should absolutely limit who you give access to. In my case, only three people can and that’s immediate family. No friends, no extended family. I don’t wanna deal with all that mess when I deal with it at work. Don’t over extend yourself by being nice.
Using Cloudflare is against the ToS when used for services like Jellyfin. Your account can be limited, closed, or find yourself getting a several hundred dollar bill for data usage because you’ve breached the terms of service. Additionally, streaming content on free accounts incurs higher latency which I’ve confirmed myself Argo smart routing massively reduces. https://github.com/jellyfin/jellyfin/issues/9295 - Don’t abuse what’s free or you may lose it.Google shouldn’t be indexing your domains anyway. If it’s flagged your domain, it’s been indexed and scanned. Alternatively, it could indicate you have a weak point somewhere on your server and you’ve been breached. Google’s scan picked up whatever it was. Though I doubt this is the case and just a false positive. Double check your robots.txt files and disallow everything. Most index bots respect this. You can use a community sourced bot blocker. https://github.com/mitchellkrogza/nginx-ultimate-bad-bot-blocker
I’ve been running my own self hosted services for almost a decade. Though I have a background in IT directly doing this kind of stuff daily at work. As long as you have a strong firewall, modern TLS, relevant security headers, automatic tools like fail2ban, and have a strong grasp on permissions, you should be fine. Before I moved everything to non-root docker, it was given its own service user and SELinux policy. Using direct DNS isn’t so much of a problem. You shouldn’t have any issues. Feel free to reach out if you have any questions.
RE: CloudFlare TOS, Not anymore. They removed section 2.8 from their TOS, so all content can be served through CloudFlare now, as long as it doesn’t use the CDN.
https://blog.cloudflare.com/updated-tos/
Can you help me to understand how to bypass the CDN while using Plex?
To bypass their CDN (referred to caching) you need to setup a Page Rule for the entire Plex domain.
https://developers.cloudflare.com/support/page-rules/how-do-i-include-or-exclude-a-specific-url-from-cloudflares-page-rules/
Cache Level set to Bypass for
https://plex.mydomain.me/*Awesome, thanks so much for the help!
Thanks for the information. Although Argo still greatly reduces latency if a user cares to reduce communication time.
The Google warning page isn’t from a scan. I’ve seen it show up when visiting an entirely internal site in Chrome. It’s not exposed to the Internet, and the domain name doesn’t even exist in public DNS.
I’m hoping it’s just a false positive. I have everything setup to not be indexed, and I just signed up for the google search console (to submit an appeal) and the console confirmed this. I was using cloudflare to block “bots and scrapers” and that seems to have blocked Google’s scraper/indexer. My best guess is they might have flagged it just for that, so I’ve turned it off for now.
As for security, it’s an ever-evolving thing but I’m looking at ways to tighten it up. Since everything is behind Cloudflare, I also have them setting up SSL certs, and running firewalls. This lets me auto-ban “known malicious actors”, as well as any IP’s that aren’t geo-located to the US. Server-side, it’s not great though. I’m running unraid, which is… not known for it’s security. Not sure if there is much I can do about that though until I re-architect everything on a proper server.
You should for sure move away from a proprietary OS. There are many ways to go about it. I personally use Arch minimal with hardened kernel. Everything runs in non-root docker containers. Commonly used distros are Ubuntu and Fedora. But there are many more to choose from. https://distrowatch.com/search.php?category=Server
Yeah, I used to run on proxmox and tried to roll-my-own stuff. I found it to be a lot of work in the areas I was less interested in, if that makes sense. I liked unraid for it’s ease of use, although I think in the end the gameplan is still to eventually move docker/applications off of the unraid box and have it be only for storage. Then I can have a regular linux box for all my applications & vms.
deleted by creator
I set up everything behind Authentik SSO so that, when they ask me to set them up with jellyfin to watch movies & tv, they suddenly have access to a whole suite of tools. That way, they can explore on their own and decide - which seems to work well. Not sure what kind of users you have, but mine are very quick to ring me up when something is not working!
I’m quite terrible at keeping up with folks, and so I find these support calls to be a great way to keep in touch actually! But I could definitely see it getting annoying too.
As much as I like fully self hosting, I ended up paying for Plex lifetime and have it running in docker. It was $120, but has already paid for itself twice over since I managed to convince my wife to drop hbo max, Netflix, and a couple others. She isn’t technical at all so she was hesitant, but she likes plex. If she can’t find what she wants to watch on our few streaming services (paid for by our cell provider, otherwise they’d be cancelled too), she can add it to the watchlist on Plex and radarr or sonarr will download it automatically and make it available on plex pretty quickly (or she’ll tell me to get it and let her know when it’s done).
I could open my Plex server to more family or friends, but most of them either pirate stuff themselves or are fine with paying for streaming services for the ease of use.